freebsd security - Oct 2016 - FreeBSD Security Advisory FreeBSD-SA-16:15.sysarch [REVISED]

You have this idea to remove local denial of service advisories.

I can understand that. :-)

My idea is to move them into benchmarks/recommendations such as CIS,
not to /dev/null, as they also provide useful information for users
and administrators. CIS-like organization of the local/configuration
advisories/recommendations would make it centralized and reproducible
way of quick system verification in an automated way. That would not
remove additional work but also would not remove important
information. That would lower the "noise" on SA list and benefit
users/admins in a new way. Just an idea..

Can you understand that? :-)

-- 
CeDeROM, SQ7MHZ, http://www.tomek.cedro.info

CeDeROM <cederom at tlen.pl> writes:
> You have this idea to remove local denial of service advisories.
No.  With very few (imho unfortunate) exceptions, we have *never* issued
advisories for local DoS exploits.  So we're not taking anything away
from you.
> My idea is to move them into benchmarks/recommendations such as CIS,
The CIS benchmarks are not lists of vulnerabilities.  They are lists of
best practices for configuring a machine, and shell scripts that tell
you whether a machine is configured correctly according to the
benchmark.

The only way to prevent local denial of service attacks is to not have
any users.  A four-byte shell script will send the load through the
roof.  A seven- or ten-byte script will render the machine unusable, and
you won't even be able to log in to kill it.  These are not bugs,
they're fundamental features of the operating system, and you can't plug
them without making the system useless for its intended purpose.

DES
-- 
Dag-Erling Sm?rgrav - des at des.no